apt: Forge reads the first control of a control.tar, while dpkg installs from the last one it extracts #807

Problem

control_in_tar (crates/formats/apt/src/deb.rs:161-182) returns the first entry named control or ./control, and skips /control. dpkg extracts the control member with tar into a directory, so a later entry of the same name overwrites the earlier one, and GNU tar strips a leading /.

Scenario

A control.tar holds ./control (Package: team-a-tool, Depends: x) followed by /control or a second ./control (Package: libc6, Version: 99).

• Forge's checks (the selector and the package id), the signed index and the web UI all show team-a-tool.
• dpkg --unpack installs libc6 99 when a client installs team-a-tool.

There is little to gain over a malicious postinst, but what the index says is not what gets installed. The npm and NuGet counterparts are #540, #554 and #572.

Expected

Refuse a control.tar with more than one entry that resolves to control after stripping ./ and /. Add a unit test in deb.rs.

New with #176 (#725). Found in the 2.2.0 release review.